Security Audit Report for AllScale's EIP7702 Contracts

The target of this audit (hereinafter referred to as the "Target") is AllScale's EIP-7702 contracts, provided as a ZIP archive. EIP7702 Contracts of AllScale is a gasless wallet infrastructure built on EIP7702 account delegation. It lets whitelisted sponsors relay signed EIP712 authorizations on behalf of EOAs, executing fee-split token transfers and deposits. All wallet logic runs through a three-layer beacon proxy pattern, enabling seamless logic upgrades without changing the delegated contract. Specifically, EOAs delegate to the contract BeaconStub, which resolves the active implementation (i.e., the contract EIP7702) from an upgradeable beacon contract. Then, the contract BeaconStub delegatecalls into the implementation to execute transfers.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we have found that the codebase contains 1 high-risk issue that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The EIP7702 Contracts team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.